CVE-2006-0996: php Cross-site Scripting

EPSS trend

Probability

11.06%

Chance of exploitation in the next 30 days

Percentile

96%

Versus all other CVEs

30-day change

+0.25 pp

From 10.81% on 19-09-2026

19-09-202619-10-2026

EPSS score

11.06%

Known exploited

Compare KEV catalogs

Not in any of the 3 tracked catalogs.

Public exploits

2 found

referenceUnverified
Exploit Reference (securityfocus.com)
Maturity: unknown
exploit-databaseremotephpVerified
PHP 4.x/5.0/5.1 - PHPInfo Large Input Cross-Site Scripting
Maturity: weaponized

References

33 links

securityreason.com/securityalert/675Third Party AdvisoryX Refsource SREASON
secunia.com/advisories/19775Third Party AdvisoryX Refsource SECUNIAVendor Advisory
secunia.com/advisories/21252Third Party AdvisoryX Refsource SECUNIAVendor Advisory
www.osvdb.org/24484VDB EntryX Refsource OSVDB
secunia.com/advisories/20222Third Party AdvisoryX Refsource SECUNIAVendor Advisory
secunia.com/advisories/20210Third Party AdvisoryX Refsource SECUNIAVendor Advisory
www.php.net/ChangeLog-4.phpX Refsource CONFIRM
support.avaya.com/elmodocs2/security/ASA-2006-160.htmX Refsource CONFIRM
www.securityfocus.com/bid/17362VDB EntryX Refsource BIDExploit
rhn.redhat.com/errata/RHSA-2006-0276.htmlVendor AdvisoryX Refsource REDHAT

Show all 33 references

security.gentoo.org/glsa/glsa-200605-08.xmlVendor AdvisoryX Refsource GENTOO
cvs.php.net/viewcvs.cgi/php-src/ext/standard/info.c?r1=1.260&r2=1.261X Refsource CONFIRMPatch
www.vupen.com/english/advisories/2006/1290VDB EntryX Refsource VUPEN
www.ubuntu.com/usn/usn-320-1Vendor AdvisoryX Refsource UBUNTU
www.redhat.com/support/errata/RHSA-2006-0501.htmlVendor AdvisoryX Refsource REDHAT
securitytracker.com/id?1015879VDB EntryX Refsource SECTRACK
securityreason.com/achievement_securityalert/34Third Party AdvisoryX Refsource SREASONRES
secunia.com/advisories/19979Third Party AdvisoryX Refsource SECUNIAVendor Advisory
rhn.redhat.com/errata/RHSA-2006-0549.htmlVendor AdvisoryX Refsource REDHAT
secunia.com/advisories/20951Third Party AdvisoryX Refsource SECUNIAVendor Advisory
secunia.com/advisories/21125Third Party AdvisoryX Refsource SECUNIAVendor Advisory
oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A10997VDB EntrySignatureX Refsource OVAL
support.avaya.com/elmodocs2/security/ASA-2006-129.htmX Refsource CONFIRM
secunia.com/advisories/19599Third Party AdvisoryX Refsource SECUNIAVendor Advisory
www.mandriva.com/security/advisories?name=MDKSA-2006:074Vendor AdvisoryX Refsource MANDRIVA
secunia.com/advisories/19832Third Party AdvisoryX Refsource SECUNIAVendor Advisory
cvs.php.net/viewcvs.cgi/php-src/ext/standard/info.cX Refsource CONFIRM
secunia.com/advisories/20052Third Party AdvisoryX Refsource SECUNIAVendor Advisory
secunia.com/advisories/21564Third Party AdvisoryX Refsource SECUNIAVendor Advisory
exchange.xforce.ibmcloud.com/vulnerabilities/25702VDB EntryX Refsource XF
www.vupen.com/english/advisories/2006/2685VDB EntryX Refsource VUPEN
www.novell.com/linux/security/advisories/05-05-2006.htmlVendor AdvisoryX Refsource SUSE
marc.info?l=php-cvs&m=114374620416389&w=2Mailing ListX Refsource MLIST

Related vulnerabilities

CVE-2018-19395phpphp4.33%7y ago20-11-2018 21:00ext/standard/var.c in PHP 5.x through 7.1.24 on Windows allows attackers to cause a denial of service (NULL pointer dereference and application crash) because com and com_safearray_proxy return NULL in com_properties_get in ext/com_dotnet/com_handlers.c, as demonstrated by a serialize call on COM("WScript.Shell").CVE-2018-19935alpinephp5+56.28%7y ago07-12-2018 09:00ext/imap/php_imap.c in PHP 5.x and 7.x before 7.3.0 allows remote attackers to cause a denial of service (NULL pointer dereference and application crash) via an empty string in the message argument to the imap_mail function.CVE-2018-19520phpphp+12.92%7y ago25-11-2018 20:00An issue was discovered in SDCMS 1.6 with PHP 5.x. app/admin/controller/themecontroller.php uses a check_bad function in an attempt to block certain PHP functions such as eval, but does not prevent use of preg_replace 'e' calls, allowing users to execute arbitrary code by leveraging access to admin template management.CVE-2018-19396phpphp4.58%7y ago20-11-2018 21:00ext/standard/var_unserializer.c in PHP 5.x through 7.1.24 allows attackers to cause a denial of service (application crash) via an unserialize call for the com, dotnet, or variant class.CVE-2018-19518canonicalubuntu_linux+1896.11%7y ago25-11-2018 10:00University of Washington IMAP Toolkit 2007f on UNIX, as used in imap_open() in PHP and other products, launches an rsh command (by means of the imap_rimap function in c-client/imap4r1.c and the tcp_aopen function in osdep/unix/tcp_unix.c) without preventing argument injection, which might allow remote attackers to execute arbitrary OS commands if the IMAP server name is untrusted input (e.g., entered by a user of a web application) and if rsh has been replaced by a program with different argument semantics. For example, if rsh is a link to ssh (as seen on Debian and Ubuntu systems), then the attack can use an IMAP server name containing a "-oProxyCommand" argument.CVE-2018-20783ubuntuphp5+45.66%7y ago21-02-2019 19:00In PHP before 5.6.39, 7.x before 7.0.33, 7.1.x before 7.1.25, and 7.2.x before 7.2.13, a buffer over-read in PHAR reading functions may allow an attacker to read allocated or unallocated memory past the actual data when trying to parse a .phar file. This is related to phar_parse_pharfile in ext/phar/phar.c.

All vulnerabilities inphp

CVE-2006-0996: php Cross-site Scripting

Vulnerability summary

Advisory lineage

Timeline

Description

CVSS metrics

EPSS trend

Known exploited

Public exploits

Weaknesses

Affected systems

References